ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 104.28.154.251:2375.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1822031
IOC: 104.28.154.251:2375
IOC Type :ip:port
Threat Type :payload_delivery
Malware: XMRIG
Confidence Level : Confidence level is high (80%)
Is compromised? : False
ASN:AS13335 CLOUDFLARENET
Country:- US
First seen:2026-06-04 05:16:14 UTC
Last seen:never
UUID:95cac648-5f8f-11f1-a345-42010aa4000a
Reporter nullblue67
Reward 5 credits from ThreatFox
Tags:backdoor-key Cloudflare container-escape docker-api nginx-alpine ssh-key-plant
Reference: https://twitter.com/NullBlue67

Avatar
nullblue67
Docker SSH key plant attack via nginx:alpine container with /host bind mount. Adds attacker ed25519 keys to /host/root/.ssh/authorized_keys for persistent root access. 2 distinct ed25519 keys observed = multiple operator infrastructure. Cloudflare-fronted attacker IP. 2026-06-03 NullBlue67.